half broken

internal/engine/engine.go

@@ -13,6 +13,7 @@ package engine
 
 import (
 	"context"
+	"encoding/hex"
 	"net/netip"
 	"strconv"
 	"strings"
@@ -32,6 +33,12 @@ import (
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/resolver"
 )
 
+// upstreamNSID is the nameserver identifier we advertise to upstreams when a
+// client asks for one. It is hex-encoded on the way into the EDNS0 option:
+// dns.EDNS0_NSID.Nsid is a hex string in this miekg/dns version, not the
+// opaque bytes RFC 5001 describes.
+const upstreamNSID = "fancy-dns"
+
 // Request describes one inbound query.
 type Request struct {
 	// Msg is the parsed query. The engine may modify it (to attach an OPT or
@@ -696,10 +703,14 @@ func (e *Engine) prepareUpstream(q *dns.Msg, req Request) *dns.Msg {
 		if opt := o.Option; opt != nil {
 			for _, oo := range opt {
 				if oo.Option() == dns.EDNS0NSID {
-					// Our own NSID, not the client's.
+					// Our own NSID, not the client's — but only when the
+					// operator has not asked us to hide. dns.EDNS0_NSID.Nsid
+					// is hex on the wire (the library hex-decodes it in pack
+					// and hex-encodes it in unpack), so a plain string here
+					// does not pack and every NSID query gets SERVFAIL.
 					if e.cfgStore == nil || !e.cfgStore.Get().DNS.HideIdentity {
 						nsid := new(dns.EDNS0_NSID)
-						nsid.Nsid = "fancy-dns"
+						nsid.Nsid = hex.EncodeToString([]byte(upstreamNSID))
 						if m.IsEdns0() == nil {
 							m.SetEdns0(maxSize, o.Do())
 						}